The symptom shows up in every operations review: the queue only grows. Analysts clear 300 alerts by lunch and 400 more arrive by five. Somewhere in that river sits the one alert that matters. The proposed cure, in 2026, is machine judgement — and the cure has a name, AIOps for Security, plus a set of conditions attached that most buyers never hear about. This is a diagnosis-first walkthrough: why the overload exists, what machine assistance genuinely fixes, and what evidence it must produce before you trust it. Expect numbers you can check, failure patterns you can recognise in your own queue, and a checklist worth running before any purchase order gets signed.

Why the queue keeps growing

Blame the arithmetic of rare events. Take the standard teaching scenario: 50 million events stream past daily and only 50 of them are genuinely hostile. A detector that misfires on one clean item in ten thousand will raise thousands of false alarms, leaving just 0.9% of its alerts tied to anything real — an analyst wades through 112 items to land one true catch. Make the detector a million times pickier and the same alert stream becomes useful, reaching 47.4% precision. Axelsson walked the same ground in 2000: at a base rate of 0.00002, a tenfold-tightened false-alarm rate lifted precision to 66.7%, while loosening it to 0.001 sank the number to roughly 1.4%. Rare positives punish loose detectors, and security events are always rare positives.

Why rule packs alone stop working

Signature lists and hand-written rules scale linearly with staff hours, while attacker behaviour mutates weekly. That gap is why machine learning keeps getting proposed for detection and triage — and why, for years, it kept failing to ship. Sommer and Paxson said it directly in their 2010 study: production security systems rarely carried ML, chiefly down to “a very high cost of errors”. A false positive wastes minutes; a false negative can cost the company. Any honest diagnosis has to hold both truths at once — the queue needs machine help, and machine help fails expensively when nobody measures it. Web and platform teams will recognise the pattern from other operations work: scaling a manual response against an automated adversary never ends well, and the fix is not more analysts but changing what one analyst-hour buys.

What AIOps for Security actually changes

Done properly, it adds scoring and triage capacity in controlled doses. Anomaly detection and behaviour analytics flag the strange; ranking models order the queue so humans read the dangerous items first; LLM assistants read evidence and draft conclusions. The doses are formalised as clearance levels, granted per action class:

• Observe-only. Output lands on a dashboard; nothing moves.
• Recommend. Permitted once a trial of 200-plus labelled alerts, containing at least 30 genuine hits, supports the model’s calls.
• Auto-close. Cleared at 2% misses or lower across 150 true positives, with decoys in the stream, a holdout kept back, and reopen one click away.
• Act, reversible only. A 1% wrong-action ceiling on 300-plus verdicts, rollback drilled, volume capped.
• Never. Anything irreversible stays with people.

Note what is absent from the ladder: a “fully automated” setting. That absence is deliberate, and it is the whole governance story in one line. Each tier exists because someone, somewhere, shipped the previous one without evidence and paid for it.

The proof burden AIOps for Security carries

Evidence standards are where enthusiasm meets arithmetic. Consider what one careful blind audit found: 1,240 emails labelled by humans in advance, 71 of them real threats, with the agent overlooking 2 — a 2.8% miss rate. Sounds acceptable until the confidence maths runs: at 95% confidence the upper bound sits near 8.6%, triple the strictest 2% ceiling demanded before autonomous closure. The same audit recorded brilliant close precision at 99.8%, shakier 86% precision on threat verdicts, and a genuine prize — 93.5% of the queue’s work removable. Real savings, real risk, decided by a gate rather than a feeling. Formal anchors exist to organise the work — NIST’s AI Risk Management Framework 1.0 dates from 2023 and is under revision, its Generative AI Profile (AI 600-1) arrived in 2024, and the E2025 update to AI 100-2 landed in March 2025 — but frameworks are scaffolding, not evidence. Sampling discipline matters as much as frameworks: a spotless random audit of 5% from roughly 1,845 quarterly closes still leaves a near-38-percent miss-rate ceiling standing, which is why practitioners seed canary records instead — about fifty per quarter, withdrawn on the third failure.

Where the fix fails without governance

The tooling fails quietly when the governance is missing. Ranking models that influence which alerts get labelled will happily steer their own future training data — the machine grading its own homework. Headline metrics stated as “percent automated” reward disposal volume rather than threat disposal, so the number climbs while the real work hides. Accuracy claims arrive pre-inflated: Gartner keeps a watchlist of “AI washing” for products wearing the vocabulary without the capability, and even honest laboratory numbers die on contact with a new tenant’s base rates. Paging on raw anomaly scores burns out rota staff for the oldest reason in the book — most anomalies are deployments, configuration changes, and last week’s new hires, not adversaries. Each failure mode has the same antidote: categories scored separately, evidence recorded monthly, and autonomy granted only where the file supports it.

Diagnosis checklist before you buy

1. Split the queue into categories and score each separately — one deployment’s tidy 1% average concealed 42.3% missed cloud-IAM cases behind a 9.1% phish rate.
2. Count your own base rates monthly; never accept a blended “accuracy” figure.
3. Ask which clearance level each action class holds, and demand the evidence file behind it.
4. Refuse “percent automated” as a headline metric — it measures ticket disposal, never threat disposal, and the difference is the entire job.
5. Treat flawless lab scores as a warning: across thirty leading security ML papers, sampling bias appeared in 90% and data snooping in 73%.

For teams building skills alongside the tooling, the Complete AIOps Training Guide: Tools, Use Cases, Certification & Career Path covers the operations side, and the guide to AIOps strategy and implementation maps how scoring programmes fit a wider operations roadmap. For the deeper specification — the ladder definitions, the evidence gates, the worked cases — the full AIOps for Security reference is the document to keep open beside this one. Read it with your own queue’s numbers in hand; the combination of outside context and inside data is what turns a plausible pitch into a checkable claim.

The diagnosis, in the end, is hardly mysterious. The queue grows because events are rare and detectors are imperfect; machine assistance helps because it reads faster than people; and it helps safely only when the evidence gates are treated as load-bearing walls, not decoration. Nothing above argues against the technology — it argues for reading the label carefully, because the same three letters that smoothed IT operations get borrowed by security marketing while the underlying disciplines could hardly differ more. Where an ops dashboard forgives a slow week, a security miss compounds into an incident. Fix the measurement, and the overload becomes tractable.